telegram-mini-app

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's examples and required workflow directly ingest and use untrusted, user-provided Telegram data via tg.initDataUnsafe (see "Basic Structure" and "React Setup") and construct/apply that data in app logic (greetings, referral links, transaction flows) so third-party user content from Telegram could materially influence behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes blockchain payment functionality and payment APIs. It documents TON Connect integration and provides concrete code that creates and sends TON transactions (tonConnectUI.sendTransaction), plus Telegram invoice/payment examples (replyWithInvoice for Telegram Stars). These are specific tools/functions for moving crypto and handling payments, so it grants direct financial execution capability.